---
id: CVE-2026-116489
title: >-
  Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN
  Operator Classes
summary: >-
  Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability
  that allows low-privileged database users to corrupt memory by shadowing
  pgvector's vector type or operators. Attackers with CREATE privilege on the
  vectorscale…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-843
vendor: timescale
product: pgvectorscale
affected:
  - pgvectorscale < 0.9.1
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T14:59:38.170Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116489'
references:
  - url: 'https://github.com/timescale/pgvectorscale/pull/280'
    label: 'Pull Request #280'
  - url: >-
      https://github.com/timescale/pgvectorscale/commit/1c7cb1cab919ac122f901f163a71f69a264a8f81
  - url: >-
      https://github.com/timescale/pgvectorscale/commit/59d2f573dbd7a1446728ac547576d22f5b05cfaa
  - url: >-
      https://github.com/timescale/pgvectorscale/commit/f42f8cf29c92111add863ccf3255b3bf23fb51cd
  - url: >-
      https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/mod.rs#L208-L231
  - url: >-
      https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/pg_vector.rs#L133-L151
  - url: >-
      https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/build.rs#L253
  - url: 'https://github.com/timescale/pgvectorscale/releases/tag/0.9.1'
    label: pgvectorscale 0.9.1 Release Notes
  - url: 'https://github.com/timescale/pgvectorscale'
  - url: >-
      https://www.vulncheck.com/advisories/timescale-pgvectorscale-before-0.9.1-type-confusion-via-unqualified-diskann-operator-classes
    label: >-
      VulnCheck Advisory: Timescale pgvectorscale before 0.9.1 Type Confusion
      via Unqualified DiskANN Operator Classes
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.504Z'
---

## Overview

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.

## Affected

- `pgvectorscale < 0.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.